PT-2026-32175 · Myt · Php Project Management+1

Published 2026-04-12 · Updated 2026-04-12 · CVE-2019-25713

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group total] parameter. Attackers can submit crafted POST requests to the /charge/admin endpoint with error-based, time-based blind, or stacked query payloads to extract sensitive database information or manipulate data.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25713

Affected Products

Php Project Management

Myt

References · 5

• 🔥 https://exploit-db.com/exploits/46084 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25713 · Security Note
• https://vulncheck.com/advisories/myt-pm-sql-injection-via-charge-group-total-parameter · Note
• https://sourceforge.net/projects/myt · Note
• https://manageyourteam.net · Note